search

btbd / umap

UEFI bootkit for driver manual mapping
523 stars 98 forks source link

Failed to find OslExecuteTransition #1

Closed ahmetabdi closed 4 years ago

ahmetabdi commented 4 years ago

Windows 10 Pro, Version 1909, 18363.778

30GB USB formatted to FAT32

Contains F:\EFI\Boot\bootx64.efi from pre-compiled release

Seems to fail here: https://github.com/btbd/umap/blob/c19878fcfe7d64a79cfc29f45ac0866c9a85f408/boot/main.c#L117

umap.exe driver.sys
Failed to communicate with the mapper

Error happends on boot:

Error

btbd commented 4 years ago

Thanks for letting me know. My 1909 VM is not the latest and I assumed the signature would not change. I'll push a fix later today.

btbd commented 4 years ago

@ahmetabdi I've just tested on the same Windows version (1909 build 18363.778) and on 1909 build 18363.815, and it is able to find the signature. Would you mind sending me your winload.efi?

ahmetabdi commented 4 years ago

@btbd Thanks for looking into it I will try a couple more times

Here is the winload.efi http://dl.free.fr/getfile.pl?file=/Cz6NWBFX

ahmetabdi commented 4 years ago

🤔 just reformatted the USB and now it's working 🤷‍♂️ sorry for the time waste

nerded1337 commented 4 years ago

@btbd fast boot is the culprit in this case.

btbd commented 4 years ago

@nerded1337 Makes sense that fast startup would cause this. Thanks for letting me know.